I85PREP
⌘ K
CSA CCZT study materials
CSA CCZT study resources

CSA CCZT: NIST and CISA Best Practices

CSA CCZT · Work through your exam, one topic at a time.

All guide sections

NIST and CISA Best Practices

NIST and CISA Best Practices is the standards-and-guidance domain. The exam checks whether you can map zero trust work to NIST SP 800-207, NIST SP 800-207A, NIST SP 1800-35, the NIST Cybersecurity Framework, and the CISA Zero Trust Maturity Model, and whether you know which document answers which question.

Core rules

  • NIST SP 800-207 (2020) is the conceptual reference: seven tenets, PE/PA/PEP, trust algorithm, deployment models, and migration guidance.
  • NIST SP 800-207A (2023) applies zero trust to cloud-native environments, including service mesh, SDP, and identity-aware proxies.
  • NIST SP 1800-35 (NCCoE) provides implementable reference designs and example architectures; use it for questions about what a build could look like.
  • NIST CSF 2.0 organizes outcomes under Govern, Identify, Protect, Detect, Respond, and Recover; map zero trust controls to these functions for governance reporting.
  • CISA's Zero Trust Maturity Model v2.0 has five pillars-Identity, Devices, Networks, Applications & Workloads, Data-plus cross-cutting Visibility & Analytics, Automation & Orchestration, and Governance. Stages are Traditional, Initial, Advanced, Optimal.
  • CISA guidance emphasizes risk-based sequencing, continuous diagnostics, and automation; federal strategy documents add deadlines and reporting, but the maturity model is not a prescriptive checklist.

Worked example

An agency assesses itself: Identity is Initial (passwords, manual provisioning), Networks are Advanced (segmented), Data is Traditional (unclassified shares). It prioritizes Identity because weak identity undermines every other pillar. Actions: phishing-resistant MFA, automated joiner/mover/leaver, and conditional access. It maps these to CSF Protect (PR.AA) and Govern (GV.PO), and sets a 12-month target of Advanced on the Identity pillar. The reasoning: the maturity model identifies gaps, but sequencing follows risk and dependency, not pillar order.

Traps that cost marks

  • Mixing the CISA pillars with the NIST seven tenets.
  • Treating 'Optimal' as a mandatory destination for every pillar.
  • Citing an outdated maturity model version or inventing stages.
  • Assuming NIST 800-207 prescribes specific products; it describes components and logic.